Privacy policy.

Nestio ("we," "our," or "us") operates the Nestio building and property management platform (the "Service") at app.nestio.gr (or such other domain as we may use). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Greek data protection laws.

The data controller responsible for your personal data is:

3.1 Account & authentication (managers / office users)

• Email address — account creation, login, notifications
• Name and profile picture — when you sign in with Google OAuth
• Account credentials — managed securely by Supabase Auth (we do not store passwords for Google sign-in)

3.2 Office & company information

• Company name — billing and identification
• Tax ID / VAT number — invoicing and compliance
• Billing address — city, postal code, country for subscription billing
• Contact phone & email — support and billing communications

3.3 Building & property data

• Building details — address, name, billing period policy, allocation settings
• Apartment data — unit identifiers, categories, ownership / tenant status
• Person / resident data — full name, email, phone (as provided by the building manager), role, apartment relationships

3.4 Financial & billing data

• Expenses — amounts, categories, vendors, allocations
• Bills — generated bills, payment status, due dates
• Payment records — transaction data via Viva or Stripe (we store references and status; payment details are handled by the payment provider)
• Subscription data — plan type, billing cycle, Stripe customer / subscription identifiers

3.5 Third-party data (provided by managers)

• ΔΕΗ contract accounts — for importing utility bills from mydei.dei.gr
• Vendor information — names, categories, contact details, invoice data

3.6 Usage & preferences

• User preferences — theme, language, notification settings, dashboard widgets
• Search / visit history — entities you have viewed (for UI convenience and search)
• Session data — resident portal sessions, magic link tokens (temporary)

When you sign in with Google (OAuth), we receive certain information from your Google account. This section describes how we access, use, store, and protect that data in compliance with the Google API Services User Data Policy.

6.1 Data accessed

Our application accesses the following Google user data when you choose to sign in with Google:

• Email address — to create and identify your account and for account-related communications
• Name — to display your identity in the Service (e.g. profile, dashboard)
• Profile picture — to display your avatar in the Service (optional; you can change it later)

We do not request or access any other Google account data (e.g. Calendar, Drive, Gmail content). We also use Google Maps and Places APIs (Geocoding, Places Autocomplete, Maps) for address-related features; these use an API key and do not access your Google account data.

6.2 Data usage

We use the Google user data we receive only to: create and maintain your Nestio account and authenticate you; display your name and profile picture within the Service; send you transactional and service-related emails. We do not use Google user data for advertising and we do not use it for any purpose unrelated to providing and operating the Nestio Service.

6.3 Data sharing

We do not sell Google user data. We do not share Google user data with third parties for their marketing or advertising purposes. The data we receive from Google is stored and processed using our infrastructure and service providers (e.g. Supabase, Resend). These providers process data only on our instructions.

6.4 Data storage & protection

Google user data we store is held in our secure systems with the same technical and organisational measures we use for all personal data: encrypted connections (HTTPS / TLS), access controls and authentication (Supabase Auth), row-level security in the database, secure handling of credentials and API keys.

6.5 Data retention & deletion

We retain the Google-derived data for as long as your account is active and as needed to provide the Service and comply with legal obligations. When you delete your account or request deletion, we delete or anonymise this data within a reasonable period (typically within 30 days), except where we must retain it for legal, tax, or regulatory reasons. You can request deletion at any time by contacting info@nestio.gr. You can also revoke our access to your Google account at Google Account permissions.

• Account & building data — retained while your account is active and as needed for the Service
• Financial records — retained as required by applicable tax and accounting laws (typically 5–10 years in Greece)
• Session & temporary data — magic links, verification codes, and similar tokens are deleted after use or expiry
• After account deletion — we delete or anonymise personal data within a reasonable period, except where we must retain it for legal or regulatory reasons

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS / TLS)
• Access controls and authentication (Supabase Auth)
• Row-level security in the database
• Secure storage of API keys and credentials

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal obligations)
• Restriction — limit processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent
• Complaint — lodge a complaint with the Hellenic Data Protection Authority

We use essential cookies and local storage for: session management and authentication; user preferences (e.g. theme, language). We do not use third-party advertising or tracking cookies. Google OAuth may set its own cookies during sign-in.

On nestio.gr, we use Plausible for cookie-free website analytics. It measures overall visits and usage without persistent visitor identifiers, advertising profiles or cross-site tracking. Plausible does not store raw IP addresses. See the Plausible data policy and our Cookies Policy for details.

If you are a resident (owner or tenant) accessing the Service via magic link or email verification: your contact data (email, phone) is provided by your building manager; we process your data to show your bills, payments, and building-related information; session tokens are temporary and deleted after use or expiry.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights:

Email: info@nestio.gr · Address: Pandoras 2, Evosmos, Thessaloniki, Greece